--- title: "Ubiquiti Express 7 vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/ubiquiti/express-7 type: product description: "Ubiquiti Express 7 has 25 published CVEs, 3 in CISA KEV and 3 with public exploits." updated: 2026-09-22 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Ubiquiti Express 7 vulnerabilities Vendor: [Ubiquiti](https://radicalnotion.ai/vendor/ubiquiti) - **Published CVEs:** 25 - **In CISA KEV:** 3 - **With a public exploit:** 3 - **With a patch:** 25 - **Average CVSS:** 8.8 - **First CVE:** 2026-05-22 - **Latest CVE:** 2026-09-22 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 12 | | High | 13 | | Medium | 0 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 5 | | [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 4 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 | | [CWE-787](https://radicalnotion.ai/cwe/cwe-787) | Out-of-bounds Write | 3 | | [CWE-93](https://radicalnotion.ai/cwe/cwe-93) | Improper Neutralization of CRLF Sequences ('CRLF Injection') | 2 | | [CWE-125](https://radicalnotion.ai/cwe/cwe-125) | Out-of-bounds Read | 2 | | [CWE-942](https://radicalnotion.ai/cwe/cwe-942) | Permissive Cross-domain Security Policy with Untrusted Domains | 1 | | [CWE-489](https://radicalnotion.ai/cwe/cwe-489) | Active Debug Code | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2026 | 25 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | \< 5.1.31 | range | 11 | | \< 5.1.19 | range | 6 | | \< 5.1.12 | range | 4 | | \< 5.1.15 | range | 4 | | 5.1.31 | patched | 11 | | 5.1.19 | patched | 6 | | 5.1.12 | patched | 4 | | 5.1.15 | patched | 4 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-95862 | - | high | 7.5 | No | No | Yes | | CVE-2026-95861 | - | high | 7.5 | No | No | Yes | | CVE-2026-77558 | - | high | 7.5 | No | No | Yes | | CVE-2026-77556 | - | high | 7.5 | No | No | Yes | | CVE-2026-77555 | - | high | 7.5 | No | No | Yes | | CVE-2026-77544 | - | high | 7.5 | No | No | Yes | | CVE-2026-77550 | - | critical | 10.0 | No | No | Yes | | CVE-2026-77549 | - | critical | 9.0 | No | No | Yes | | CVE-2026-77545 | - | critical | 9.0 | No | No | Yes | | CVE-2026-77536 | - | critical | 9.9 | No | No | Yes | | CVE-2026-77534 | - | critical | 9.9 | No | No | Yes | | CVE-2026-55116 | - | critical | 9.8 | No | No | Yes | | CVE-2026-54401 | - | high | 8.8 | No | No | Yes | | CVE-2026-54402 | - | critical | 9.9 | No | No | Yes | | CVE-2026-55110 | - | high | 7.5 | No | No | Yes | | CVE-2026-54404 | - | high | 8.8 | No | No | Yes | | CVE-2026-54403 | - | high | 8.6 | No | No | Yes | | CVE-2026-47370 | - | critical | 9.9 | No | No | Yes | | CVE-2026-47369 | - | critical | 9.9 | No | No | Yes | | CVE-2026-47368 | - | high | 8.6 | No | No | Yes | | CVE-2026-48610 | - | high | 8.1 | No | No | Yes | | CVE-2026-34911 | - | high | 7.7 | No | No | Yes | | CVE-2026-34910 | - | critical | 10.0 | Yes | Yes | Yes | | CVE-2026-34908 | - | critical | 10.0 | Yes | Yes | Yes | | CVE-2026-34909 | - | critical | 10.0 | Yes | Yes | Yes | ## Frequently asked questions ### How many CVEs does Ubiquiti Express 7 have? Ubiquiti Express 7 has 25 published CVE records since 2026. ### How many Ubiquiti Express 7 CVEs are in CISA KEV? 3 of Ubiquiti Express 7's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline. ### Are there public exploits for Ubiquiti Express 7 vulnerabilities? Yes — 3 of Ubiquiti Express 7's CVEs have a known public exploit. ### Which versions of Ubiquiti Express 7 are affected? 8 distinct Ubiquiti Express 7 versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Ubiquiti Express 7 CVEs? Ubiquiti Express 7's CVEs most often map to these CWE weakness types: CWE-284 (Improper Access Control), CWE-20 (Improper Input Validation), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-787 (Out-of-bounds Write). ### How many critical Ubiquiti Express 7 vulnerabilities are there? Ubiquiti Express 7 has 12 critical and 13 high-severity CVEs. ### What is the average severity of Ubiquiti Express 7 CVEs? The average CVSS base score across Ubiquiti Express 7's scored CVEs is 8.8. ## Other products from this vendor - [UniFi OS Server](https://radicalnotion.ai/vendor/ubiquiti/unifi-os-server) (20 CVEs) - [Cloud Gateways](https://radicalnotion.ai/vendor/ubiquiti/cloud-gateways) (18 CVEs) - [Dream Machines](https://radicalnotion.ai/vendor/ubiquiti/dream-machines) (18 CVEs) - [Dream Routers](https://radicalnotion.ai/vendor/ubiquiti/dream-routers) (18 CVEs) - [Dream Wall](https://radicalnotion.ai/vendor/ubiquiti/dream-wall) (18 CVEs) - [UniFi Network Application](https://radicalnotion.ai/vendor/ubiquiti/unifi-network-application) (16 CVEs) - [EdgeRouter X](https://radicalnotion.ai/vendor/ubiquiti/edgerouter-x) (14 CVEs) - [Express](https://radicalnotion.ai/vendor/ubiquiti/express) (12 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/ubiquiti/express-7). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.